EV 263 600 797 US 



SUN-040024 
(811173-000414) 



CLAIMS 

What is claimed is: 

1. A method for executing an obfuscated application program, the method comprising: 
receiving an obfuscated application program, said obfuscated application program 

comprising at least one instruction opcode value encoded using one of a plurality of 
instruction set opcode value encoding schemes; 
receiving an application program instruction corresponding to a current instruction counter 

value; 

selecting an instruction dispatch table based at least in part on said current instruction counter 
value; and 

executing said application program instruction using said selected instruction dispatch table. 



2. The method of claim 1 , further comprising: 

determining whether there is another application program instruction to be executed; 
advancing said current instruction counter if there is another application program instruction 
to be executed; and 

repeating said receiving, said selecting and said executing after said advancing. 
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3. The method of claim 1 wherein said selecting further comprises: 

performing modulo-n arithmetic operation on said current instruction counter value, where n 
is the number of dispatch tables, each of said dispatch tables associated with a unique 
number between 0 and n- 1 ; and 

selecting the instruction dispatch table associated with the result of said operation. 

4. The method of claim 1 wherein the number of instruction dispatch tables is based at least in 
part on the number of instructions in the largest method of said application program. 

5. The method of claim 4 wherein said number of instruction dispatch tables is greater than or 
equal to said number of instructions. 

6. The method of claim 5 wherein said number of instruction dispatch tables equals said number 
of instructions. 

7. The method of claim 1 wherein the number of instruction dispatch tables is based at least in 
part on an amount of available memory. 

8. A method for application program obfuscation, the method comprising: 
reading an application program comprising code; 

determining a plurality of dispatch tables associated with said application program; 
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transforming said application program into application program code configured to utilize 
said plurality of dispatch tables during application program execution to determine the 
location of instruction implementation methods to be executed based at least in part on a 
current instruction counter value; and 
sending said application program code. 

9. The method of claim "8 wherein said determining further comprises determining the encoding 
of said plurality of dispatch tables based at least in part on a relative frequency of instructions 
in said application program code. 

10. The method of claim 8 wherein said determining further comprises filtering said plurality of 
dispatch tables to flatten the frequency distribution of instructions over said transformed 
application program code. 



1 1. The method of claim 8 wherein 

said method further comprises, after said transforming, applying a cryptographic process to 

said application program code together with a cryptographic key to create an encrypted 

obfuscated application program; and 
said sending comprises sending said encrypted obfuscated application program. 
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12. A program storage device readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for executing an obfuscated application 
program, the method comprising: 

receiving an obfuscated application program, said obfuscated application program 

comprising at least one instruction opcode value encoded using one of a plurality of 
instruction set opcode value encoding schemes; 

receiving an application program instruction corresponding to a current instruction counter 

value; 

selecting an instruction dispatch table based at least in part on said current instruction counter 
value; and 

executing said application program instruction using said selected instruction dispatch table. 



13. The program storage device of claim 12, said method further comprising: 

determining whether there is another application program instruction to be executed; 
advancing said current instruction counter if there is another application program instruction 
to be executed; and 

repeating said receiving, said selecting and said executing after said advancing. 



14. The program storage device of claim 12 wherein said selecting further comprises: 

performing modulo-n arithmetic operation on said current instruction counter value, where n 
is the number of dispatch tables, each of said dispatch tables associated with a unique 
number between 0 and n-T, and 
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selecting the instruction dispatch table associated with the result of said operation. 



15. The program storage device of claim 12 wherein the number of instruction dispatch tables is 
based at least in part on the number of instructions in the largest method of said application 
program. 

16. The program storage device of claim 15 wherein said number of instruction dispatch tables is 
greater than or equal to said number of instructions. 

17. The program storage device of claim 16 wherein said number of instruction dispatch tables 
equals said number of instructions. 

18. The program storage device of claim 12 wherein the number of instruction dispatch tables is 
based at least in part on an amount of available memory. 



19. A program storage device readable by a machine, embodying a program of instructions 
executable by the machine to perform a method for application program obfuscation, the 
method comprising: 

reading an application program comprising code; 

determining a plurality of dispatch tables associated with said application program; 
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transforming said application program into application program code configured to utilize 
said plurality of dispatch tables during application program execution to determine the 
location of instruction implementation methods to be executed based at least in part on a 
current instruction counter value; and 
sending said application program code. 

20. The prop** storage device of claim 19 wherein said decerning further comprises 
determining the encoding of said plnrality of drspatch tables based at least in par. on a 
relative frequency of instructions in said application program code. 

21. The program storage device of claim 19 wherein said determmmg further comprises filtering 
said plurality of dispatch tables to flatten the frequency distribution of instructions over said 
transformed application program code. 



22. The program storage device of claim 19 wherein 

said method further comprises, after said transforming, applying a cryptographic process to 
said application program code together with a cryptographic key to create an encrypted 
obfuscated application program; and 
said sending comprises sending said encrypted obfuscated application program. 
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23. An apparatus for executing an obfuscated application program, the apparatus comprising: 
means for receiving an obfuscated application program, said obfuscated application program 
comprising at least one instruction opcode value encoded using one of a plurality of 
instruction set opcode value encoding schemes; 
means for receiving an application program instruction corresponding to a current instruction 

counter value; 

means for selecting an instruction dispatch table based at least in part on said current 

instruction counter value; and 
means for executing said application program instruction using said selected instruction 

dispatch table. 



24. The apparatus of claim 23, further comprising: 

means for determining whether there is another application program instruction to be 
executed; 

means for advancing said current instruction counter if there is another application program 

instruction to be executed; and 
means for repeating said receiving, said selecting and said executing after said advancing. 

25. The apparatus of claim 23 wherein said means for selecting further comprises: 

means for performing modulo-n arithmetic operation on said current instruction counter 
value, where n is the number of dispatch tables, each of said dispatch tables associated 
with a unique number between 0 and n-1; and 
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means 



for selecting the instruction dispatch table associated with the result of said operation. 



26. The apparatus of claim 23 wherein the number of instruction dispatch tables is based at least 
in part on the number of instructions in the largest method of said application program. 

. 27. The apparatus of claim 26 wherein said number of instruction dispatch tables is greater than 
or equal to said number of instructions. 

28. The apparatus of claim 27 wherein said number of instruction dispatch tables equals said 
number of instructions. 

29. The apparatus of claim 23 wherein the number of instruction dispatch tables is based at least 
in part on an amount of available memory. 



30. An apparatus for application program obfuscation, the apparatus comprising: 
means for reading an application program comprising code; 

means for determining a plurality of dispatch tables associated with said application program; 

means for transforming said application program into application program code configured to 
utilize said plurality of dispatch tables during application program execution to 
determine the location of instruction implementation methods to be executed based at 
least in part on a current instruction counter value; and 
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means for sending said application program code. 

31. The apparatus of claim 30 wherein said means for determining further comprises means 
determining the encoding of said plurality of dispatch tables based at least in part on a 
relative frequency of instructions in said application program code. 
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32. The apparatus of claim 30 wherein said means for determining further comprises filtering 
said plurality of dispatch tables to flatten the frequency distribution of instructions over sa 
transformed application program code. 



33. The apparatus of claim 30 wherein 

said apparatus further comprises, means for applying a cryptographic process to said 
application program code together with a cryptographic key to create an encrypted 
obfuscated application program in response to said transforming; and 
said means for sending comprises means for sending said encrypted obfuscated application 
program. 
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34. An apparatus for executing an obfuscated application program, the apparatus comprising a 
user device configured to: 

receive an obfuscated application program, said obfuscated application program comprising 
at least one instruction opcode value encoded using one of a plurality of instruction set 
opcode value encoding schemes; 

receive an application program instruction corresponding to a current instruction counter 

value; 

select an instruction dispatch table based at least in part on said current instruction counter 
value; and 

execute said application program instruction using said selected instruction dispatch table. 

35. The apparatus of claim 34, said user device further configured to: 

determine whether there is another application program instruction to be executed; 
advance said current instruction counter if there is another application program instruction to 
be executed; and 

repeat said receiving, said selecting and said executing after said advancing. 

36. The apparatus of claim 34 wherein said user device is further configured to: 

perform modulo-n arithmetic operation on said current instruction counter value, where n is 
the number of dispatch tables, each of said dispatch tables associated with a unique 
number between 0 and n-1; and 

select the instruction dispatch table associated with the result of said operation. 
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37. The apparatus of claim 34 wherein the number of instruction dispatch tables is based at least 
part on the number of instructions in the largest method of said application program. 



in 



38. The apparatus of claim 37 wherein said number of instruction dispatch tables is greater 
or equal to said number of instructions. 



39. The apparatus of claim 38 wherein said number of instruction dispatch tables equals said 
number of instructions. 

40. The apparatus of claim 34 wherein the number of instruction dispatch tables is based at least 
in part on an amount of available memory. 

41. An apparatus for application program obfuscation, the apparatus comprising an application 
program provider configured to: 

read an application program comprising code; 

determine a plurality of dispatch tables associated with said application program; 

transform said application program into application program code configured to utilize said 
plurality of dispatch tables during application program execution to determine the 
location of Instruction implementation methods to be executed based at least in part on a 
current instruction counter value; and 
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send said application program code. 



42. The apparatus of claim 41 wherein said application program provider is further configured to 
determine the encoding of said plurality of dispatch tables based at least in part on a relative 
frequency of instructions in said application program code. 

43. The apparatus of claim 41 wherein said application program provider is further configured to 
filter said plurality of dispatch tables to flatten the frequency distribution of instructions over 
said transformed application program code. 



44. The apparatus of claim 41 wherein 

said application program provider is further configured to apply a cryptographic process to 
said application program code together with a cryptographic key to create an encrypted 
obfuscated application program; and 

said application program provider is further configured to send said encrypted obfuscated 

application program. 

45. A memory for storing data for access by an application program being executed on a data 
processing system, comprising: 

a data structure stored in said memory, said data structure including information used by said 
application, program execute an obfuscated application program, said data structure 
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comprising application program code configured to utilize a plurality of dispatch tables 
during execution of said obfuscated application program to determine the location of 
instruction implementation methods to be executed based at least in part on a current 
instruction counter value. 

46. The memory of claim 45 wherein said data structure further comprises a cryptographic key 
and protected data, said protected data encrypted using said cryptographic key. 



47. The memory of claim 45 wherein said data structure further comprises an obfuscation 
descriptor that indicates an obfuscation method used to create said obfuscated application 
program. 

48. A memory for storing data for access by an application program being executed on a data 
processing system, comprising: 

a data structure stored in said memory, said data structure including information used by said 
application program execute an obfuscated application program, said data structure 
comprising a plurality of dispatch tables used during execution of said obfuscated 
application program to determine the location of instruction implementation methods to 
be executed based at least in part on a current instruction counter value. 
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